PT-2026-110047 · WordPress · Simple Membership
CVSS v3.1
4.7
Medium
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Simple Membership versions prior to 4.8.3
Description
When the optional auto-login-after-registration feature is enabled, the plugin transmits a newly registered member's plaintext password within a URL query string. This behavior exposes credentials in browser history and within web server, proxy, and CDN access logs.
Recommendations
Update Simple Membership to version 4.8.3 or later.
As a temporary mitigation, disable the auto-login-after-registration feature.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Simple Membership